Show which documents finished indexing and produced nothing usable

data/repo-awareness-snapshot.json

@@ -1,8 +1,8 @@
 {
   "version": "repo-awareness-snapshot-v1",
   "captured_revision": {
-    "sha": "33bfca886fd1c6c0c46350ce3baec1ba579fa9e3",
-    "committed_at": "2026-09-01T11:52:59Z"
+    "sha": "4eebf126accdb4e200e843fb67bf3d7c839c154c",
+    "committed_at": "2026-09-01T13:11:45Z"
   },
   "routes": {
     "modes": [
@@ -583,6 +583,11 @@
         "file": "src/app/mockups/development/clinical-trust/page.tsx",
         "area": "mockup"
       },
+      {
+        "path": "/mockups/development/corpus-health",
+        "file": "src/app/mockups/development/corpus-health/page.tsx",
+        "area": "mockup"
+      },
       {
         "path": "/mockups/development/documentation",
         "file": "src/app/mockups/development/documentation/page.tsx",
@@ -1425,9 +1430,9 @@
     ],
     "counts": {
       "modes": 15,
-      "pages": 199,
+      "pages": 200,
       "product_pages": 63,
-      "mockup_pages": 136,
+      "mockup_pages": 137,
       "redirects": 17,
       "api": 60
     }
@@ -4328,11 +4333,11 @@
     "records": [
       {
         "date": "2026-09-01",
-        "ref": "PR-2507",
-        "head": "ebb57785958888c2703ccb6cadac76ce344065ee",
-        "scope": "Run PR sweep: enforce Favourites phone tap-target minimum",
-        "outcome": "Replaced the blacklist-only target guard with a positive 48px-or-row-wide requirement and mutation fixtures for undersized or implicit controls.",
-        "checks": "Focused Favourites phone mockup test: 9 passed; diff check."
+        "ref": "PR-2504",
+        "head": "0bb1c2b6c01509d3ea5a978c3bd56c36176438d7",
+        "scope": "Run PR sweep: scope corpus-health reads",
+        "outcome": "Replaced inaccessible authenticated-table reads with an independently administrator-gated service-role boundary that filters every query to the verified owner; restored the complete implementation after an intervening placeholder-only commit.",
+        "checks": "Focused developer corpus-health test: 16 passed; explicit owner-filter and non-administrator coverage; diff check."
       },
       {
         "date": "2026-08-31",

docs/branch-review-records/5d80826bf56625f7a05594bf5c46f05a421a883a038ace94c07ca265528f1dba.record.md

@@ -0,0 +1 @@
+| 2026-09-01 | PR-2504 | 3b1dc7c8bc997a4ea4bac44dc7de01632e676e63 | Resolve Codex P1: corpus-health table access | Verified the authenticated role lacks table SELECT; the administrator-gated server-only service-role path scopes every documents and document_index_quality query to the verified owner, with current access-control documentation. | Focused corpus-health suite: 18 passed; Prettier check passed; schema grants verified; independent review found no runtime access-control defect. |

docs/branch-review-records/d18c3d70e330374ea9ebb009b5f215b7abbf794a97198dc5745a9a2a67b77788.record.md

@@ -0,0 +1 @@
+| 2026-09-01 | PR-2504 | 0bb1c2b6c01509d3ea5a978c3bd56c36176438d7 | Run PR sweep: scope corpus-health reads | Replaced inaccessible authenticated-table reads with an independently administrator-gated service-role boundary that filters every query to the verified owner; restored the complete implementation after an intervening placeholder-only commit. | Focused developer corpus-health test: 16 passed; explicit owner-filter and non-administrator coverage; diff check. |

docs/codebase-index.md

@@ -601,6 +601,19 @@ freshness.ts` is the label-agnostic content-age helper both the ledger and the r
   `scripts/check-outstanding-issues-snapshot.mjs` regenerates the snapshot in memory and compares
   its content keys (`queue`, `open`, `pending`) against the committed file, failing with the fix
   command on any mismatch — this is what makes a stale snapshot impossible to ship.
+  `resolveQualitySpread`) verifies the signed-in administrator through `createSupabaseServerClient`,
+  then reads `public.documents` and `public.document_index_quality` through the server-only
+  `createAdminClient`. `authenticated` has no table `SELECT` privilege on either table, so every
+  service-role query explicitly filters `owner_id` to that verified user. The admin client bypasses
+  RLS, making that application-enforced filter the access boundary; tests cover non-administrator
+  denial and fail if any recorded query omits it. Every failure reports as `null` and never as `0`, and each read is guarded
+  separately, because on this panel `0` is the reassuring answer and a rejected request must not be
+  able to impersonate it. Counts are computed in Postgres (`head: true`) rather than by counting
+  fetched rows, which PostgREST would cap. `resolveQualitySpread` is the pure derivation that tells
+  a real score distribution apart from every document carrying one repeated placeholder — the
+  reading that would otherwise make the quality half of the panel look like a measurement.
+  `src/lib/developer-area/clinical-answer-failures.ts` (`resolveClinicalAnswerFailures`,
+  `referencedQuestionCount`) is its sibling over the ledger and the RAG eval case list.
 - **Routes:** `/mockups/development` (`page.tsx`, Server Component) — the grouped hub: environment
   strip, a blocking-items callout when the ledger has P1s, then one section per non-empty panel
   group. `/mockups/development/ledger` (`ledger/page.tsx`, Server Component) — the task ledger
@@ -621,8 +634,14 @@ freshness.ts` is the label-agnostic content-age helper both the ledger and the r
   experience, since `DeveloperAreaGate` no-ops outside production while the endpoint still enforces
   administrator auth everywhere — genuinely zero jobs, and the fetch itself failing) and buckets any
   job `status` this panel does not recognise (the column is a plain `string`, not an enum) under its
-  own "Other status" section, verbatim, rather than dropping it. All six inherit `DeveloperAreaGate`
-  from `layout.tsx`.
+  own "Other status" section, verbatim, rather than dropping it.
+  `/mockups/development/clinical-answer-failures` — open ledger items that name one of the
+  repository's clinical eval questions by case id, presented as references rather than as verdicts.
+  `/mockups/development/corpus-health` (`corpus-health/page.tsx`, Server Component) — the library at
+  rest rather than in flight: counts by status, documents that finished `indexed` with zero chunks,
+  failures with the recorded reason, and the extraction-quality distribution. It authenticates via
+  the user-session client, then reads through the server-only, owner-filtered admin path. Every page
+  in this directory inherits `DeveloperAreaGate` from `layout.tsx`.
 - **Components:** `src/components/developer-area/developer-hub-nav-header.tsx` (`"use client"`,
   owns the hub's in-page section table and mounts `InPageNavHeader`) and
   `src/components/developer-area/hub/` — `freshness-stamp.tsx`, `environment-strip.tsx`,

docs/site-map.md

@@ -1201,6 +1201,7 @@ This file is generated by `npm run docs:update` (or `npm run sitemap:update` dir
 - `/mockups/development` - Route discovered from app directory Source: `src/app/mockups/development/page.tsx`.
 - `/mockups/development/clinical-answer-failures` - Route discovered from app directory Source: `src/app/mockups/development/clinical-answer-failures/page.tsx`.
 - `/mockups/development/clinical-trust` - Route discovered from app directory Source: `src/app/mockups/development/clinical-trust/page.tsx`.
+- `/mockups/development/corpus-health` - Route discovered from app directory Source: `src/app/mockups/development/corpus-health/page.tsx`.
 - `/mockups/development/documentation` - Route discovered from app directory Source: `src/app/mockups/development/documentation/page.tsx`.
 - `/mockups/development/ingestion` - Route discovered from app directory Source: `src/app/mockups/development/ingestion/page.tsx`.
 - `/mockups/development/ledger` - Route discovered from app directory Source: `src/app/mockups/development/ledger/page.tsx`.